CVE-2024-49769
highpriority · track · 30EPSS 0.014 · 72 %ileDEEURUUSEPSS · scored 2026-10-27
Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (21)
Products and version ranges known to be affected.
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2024-3488Red Hat OpenShift Container Platform: Mehrere SchwachstellenDeutsch2024-11-18csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Container Platform ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service zu verursachen.
- GHSA-3f84-rpwh-47g6Waitress vulnerable to DoS leading to high CPU usage/resource exhaustion2024-10-29ghsa · osvUS
### Impact When a remote client closes the connection before waitress has had the opportunity to call `getpeername()` waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. ### Patches Waitress 3.0.1 contains fixes that remove the race condition. ### Workarounds No work-around. ### References - https://github.com/Pylons/waitress/issues/418 - https://github.com/Pylons/waitress/pull/435
- PYSEC-2024-2112024-10-29vendor · osvUS
Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won't correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition.
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (14)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2024-49769cnnvd
- https://github.com/Pylons/waitress/commit/1ae4e894c9f76543bee06584001583fc6fa8c95ccnnvd
- https://github.com/Pylons/waitress/issues/418cnnvd
- https://github.com/Pylons/waitress/pull/435cnnvd
- https://github.com/Pylons/waitress/security/advisories/GHSA-3f84-rpwh-47g6cnnvd
- https://github.com/Pylons/waitress/commit/1ae4e894c9f76543bee06584001583fc6fa8c95cenisa_euvd
- https://github.com/Pylons/waitress/issues/418enisa_euvd
- https://github.com/Pylons/waitress/pull/435enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan